guest VA to host PA translation with QEMU-KVM

I have been using kvm and qemu for sometime now and had some questions about how things work.

Let's say that I have a QEMU VM running Ubuntu(x86_64) on an Ubuntu host(x86_64).

QEMU is started up with -enable-kvm for hardware acceleration.

1. Because hardware acceleration is enabled, guest instructions(both userspace and kernel) execute on the real CPU, and there is no binary translation involved/required. Is this correct?
2. The instructions work with guest virtual addresses. This guest virtual address is converted to a guest physical address by a page table traversal starting from guest-CR3. Is this correct?
3. The guest physical address space is set up by QEMU; by issuing ioctl calls to KVM. The ioctl is KVM_SET_USER_MEMORY_REGION; the argument to this ioctl contains information about guest_physical_address and userspace_addr(which im guessing is a host userspace address).

So when a guest instruction reads/writes to memory, what is the overall translation process?

guest VA -> guest PA using page table pointed to by guest CR3

then,

guest PA -> host PA using extended page table pointed to by (EPT base pointer in VMCS)

Is this correct?

4. If so, where exactly is the mapping between guestPA and hostPA set up?
5. Where in this picture do KVM shadow page tables come in? Why are they needed?